What is just crucial, really, what it's all about, that is, where the value is, necessarily, inescapably is just in the two rates, the false alarm rate and the detection rate. If can't say at least good things about false alarm rate, then have a definite maybe.

The OP struggled with the false alarm rate -- my work solved that problem.

Really, essentially inescapably and necessarily, the core of the work has to be a statistical hypothesis test.

So, what is that? We make an assumption, typically, that the system we are monitoring is healthy. Commonly that assumption is called the null hypothesis, that is, null in the sense of nothing wrong.

That assumption leads to some mathematical assumptions that can be used as hypotheses in some theorems with proofs.

Then, that assumption with some real data let's us calculate the probability of getting data like we just observed.

If that probability is relatively small, then we have (A) the system is healthy and we just observed something quite rare or (B) the system is sick. If the probability is really small and/or the health of the system is really important, then we guess that case (A) is too rare to be believed, we reject the assumption, the null hypothesis, and conclude (B) that the system is sick.

That's a short description of statistical hypothesis testing for 100+ years a main pillar of pure and applied statistics and a lot in science, both social and physical.

But for monitoring computer server farms, this context very much need the test to be both multidimensional and distribution-free. The world wide collection of those was from tiny down to zero -- likely and apparently zero. So, I invented a nice, large collection of them.

The core of the work was really some novel derivations, right, with theorems and proofs, in, call it, applied probability.

Then I worked out some algorithms to make the computing fast.

The work is likely and apparently the best approach to do zero day monitoring for health and wellness in high end server farms and networks. And there may be some other applications.

Zero day is the case where we are looking for problems never seen before. So, it's sometimes called behavioral monitoring.

Sure, should monitor for all problems have seen before, and there we should be able to do relatively well on the two rates. But, after those old problems, we still need to look for new ones -- sorry 'bout that.

I did this work a long time ago and presented it, or put it in front of, a lot of people, but no one was much interested.

From time to time, people have, as in the OP, rediscovered the problem and done this and that with it. E.g., there was a project of profs Fox and Patterson at Stanford and Berkeley funded by Google, Microsoft, and Sun and in part considered monitoring -- looking at their work, I thought that mine was better.

Sure, there was

http://www.sans.org/resources/idfaq/behavior_based.php

where it was claimed that behavioral monitoring had high false alarm rates. Nope -- my work doesn't! Instead, with my work, get to select false alarm rates over a wide range, including quite small.

I have another project, and for it I recently completed writing the version 1.0 software -- 18,000 programming language statements in 80,000 lines of text (with comments, blank lines, etc). I want to go live ASAP. This project is much easier for people to like! E.g., don't have to get people interested in rates of false alarms and detections. If the project grows, then I will implement and deploy my anomaly detection ideas for my server farm.

Otherwise, for now, I'm no longer interested in that anomaly work mostly because no one else is. Others are welcome, from time to time, to rediscover the problem, struggle with false alarm rate, see no good, general results on detection rate, etc., think that the key is artificial intelligence or machine learning or some such (I didn't use either), etc. Uh, it's statistical hypothesis testing, guys. Sorry 'bout that.

For more, see, say some of the classics:

E. L. Lehmann, Testing Statistical Hypotheses.

E. L. Lehmann, Nonparametrics: Statistical Methods Based on Ranks.

Sidney Siegel, Nonparametric Statistics for the Behavioral Sciences.

Once I presented my work to Cisco. Their reaction was that my work was "just statistical". Well, what the heck do you expect? Want something deterministic, 0 or 1, for healthy or sick? Do you realize what the heck you are asking for?

Another time I presented the work and the reaction was, "What we really want is diagnosis." Gads. You are Sony -- or some other big organization, take your pick from various headlines from current to going way back -- and your server farm is under attack with gigabytes or terabytes on the way out the door to hackers, your whole company is at risk of going belly up, and you don't want to know that there's a serious problem until you can also be told just what the heck to do about it? Sure that's your view?

Gee, you don't want to know that your car's about out of gas unless you are also told that you can get more gas right away? Ever drive in rural Montana? Like long walks? What about engine oil pressure or coolant temperature -- don't want to know about those, either? Or your blood pressure? Not until can be told just what to do about it? Sure about that?

It's an important problem. I did the work. It's good work. But if people are not much interested, then so be it -- I'm not into pushing big rocks up long hills for no good reason.

Suspicion: A guy has a sore on his foot. He knows it's there. It hurts. But he lives with it. He's tried this and that, but he still has the sore. Someone has a good cure, but he is so used to putting up with the sore that he ignores the good solution. Besides, he didn't see a way to cure the sore so doesn't believe that anyone else could either.

Even worse, my solution is not really computer science but is, really, some applied math, actually applied probability, and such work, especially new such work, is rare in practice.

More generally, good, new stuff is rare, so rare that people are very reluctant to consider that they should pay any attention to it.

Fine: Let them live with a sore foot.